TI-2019-04451 Aliases CVE-2019-6257 GHSA-3qhm-qfj3-4rrx

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow…

LOW 36CWE-918Published 2019-01-14 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.

Why it matters now

EPSS 0.01098 65th percentileScored 2026-11-07

Fix Fixed studio-42/elfinder (Packagist): 2.1.49

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	studio-42/elfinder (Packagist)	before 2.1.49	2.1.49	Patch available	GHSA-3qhm-qfj3-4rrx

— Vendor— Affected all versions Fixed in — No fix listed CNA
studio-42/elfinder (Packagist) Vendor— Affected before 2.1.49 Fixed in 2.1.49 Patch available GHSA-3qhm-qfj3-4rrx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:std42:elfinder::::::::	before 2.1.46	Vulnerable	Std42

cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:* Versions before 2.1.46 Vulnerable ·Std42

Remediation

Fix · GHSA-3qhm-qfj3-4rrx studio-42/elfinder (Packagist) Fixed in 2.1.49 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-6257
2026-10-03 Alias added: GHSA-3qhm-qfj3-4rrx

References

Patch 1

https://github.com/Studio-42/elFinder/commit/2f522db8f037a66ce9040ee0b216aa4a0359286c

Advisory 2

Other 4

TI-2019-06652 elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. CVSS 3.0CRITICAL 9.8
TI-2023-28504 Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no… CVSS 3.1CRITICAL 9.8
TI-2021-12350 Multiple vulnerabilities leading to RCE CVSS 3.1CRITICAL 9.8
TI-2022-10186 connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. CVSS 3.1CRITICAL 9.1
TI-2021-19360 A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via… CVSS 3.1CRITICAL 9.8
TI-2022-10265 In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution… CVSS 3.1CRITICAL 9.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences